CVE-2024-6655 Gtk3: gtk2: library injection from cwd

2024-07-1615:05:55

CWE-94

redhat

github.com

cve-2024-6655

gtk3

library injection

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

6.5

Confidence

Low

SSVC

Exploitation

none

Automatable

Technical Impact

total

JSON

A flaw was found in the GTK library. Under certain conditions, it is possible for a library to be injected into a GTK application from the current working directory.

References

access.redhat.com/security/cve/CVE-2024-6655

bugzilla.redhat.com/show_bug.cgi?id=2297098

gitlab.gnome.org/GNOME/gtk/-/merge_requests/7361/diffs?commit_id=3bbf0b6176d42836d23c36a6ac410e807ec0a7a7#diff-content-e3fbe6480add9420b69f82374fb26ccac2c015a0